Private Preview - features may change without notice
GramSpec
Architecture Spec API Reference Pricing About
Start free

Share it · 16

Who sees which rows

The answer to “our agents must only see their own accounts.” The owner picks the column that says whose row it is and gives each person their values. Every tile and every list of values then narrows to those rows for that person. Someone with no value sees an empty board that says so, never the whole book.

Limiting what each person sees. One flow is the owner choosing the column, seeing every tile tried against it, and giving each person their values. The other is a teammate opening the board, with their values written into every tile's query before it runs.GRAMSPECYOUR DATAYou, the ownerA teammateLimit what eachperson seesone column, then a valuefor each personEvery tile triedfirstthose that cannot benarrowed are namedWho sees whatthe column, and eachperson's valuesTheir rows onlywritten into each query,and proven to be thereThe boardYour databaseread-only123123 Limiting what each person sees. One flow is the owner choosing the column, seeing every tile tried against it, and giving each person their values. The other is a teammate opening the board, with their values written into every tile's query before it runs.GRAMSPECYOUR DATAYou, theownerAteammateLimit whateach personseesEvery tiletried firstWho sees whatthe column, andeach person'svaluesTheir rowsonlywritten into eachquery, and provento be thereThe boardYourdatabaseread-only123123
Blue circles set it up. Green squares are a teammate opening the board.

Setting it up

  1. The owner picks the column that says whose rows these are. The agent on a policy, the rep on an order. It is picked from what the model declares and never typed, so a typo cannot quietly become a rule that matches nothing.
  2. Every tile is tried before it switches on. With the real engine on the real saved queries. A tile that never reads the secured table has nothing to narrow, so those are named one by one, for the owner to change or accept.
  3. Each person is given their values. On a list of everyone the board is shared with. A blank means that person sees nothing, and the list says so. The owner is on it like everyone else.

A teammate opens the board

  1. A teammate opens the board. They do nothing different. No setting of theirs can lift the limit.
  2. Their values are written into every tile's query. Where a tile reads a different table, the limit reaches it through the joins the model declares. Then it is proven: if the limit did not land in the query that is about to run, the tile is refused. It never falls back to showing every row.
  3. The query runs on the owner's connection. The lists of values a slicer offers are narrowed the same way, so a person cannot read another's customers off a list.

Seeing it as someone else. The owner can pick a person and watch the same board answer as that person would see it. Only the owner can, and the board says plainly, for as long as it lasts, whose view it is showing.